When Red Hat and IBM first introduced Project Lightwell in late May, it was framed as a response to a fast-changing AI security landscape. Just weeks later, the initiative has moved from concept to commercial availability, a rapid expansion that reflects how quickly frontier AI risks are reshaping enterprise security priorities.
The initiative, which the companies announced on May 28, was launched commercially on July 8 and has early customers using the service.
Brian Gracely, Senior Director of Portfolio Strategy at Red Hat, told CX Today in an interview that the pace is not accidental. As AI accelerates software development and threat activity, security programs that once evolved over quarters or years now need to move in weeks.
“The service has moved very quickly,” Gracely said. “We've gotten a lot of really good input from the market in terms of the nuances of how content is handled, how embargoes work.”
For enterprises, and particularly for customer experience leaders increasingly responsible for AI-powered customer journeys, the launch is a signal that security can no longer sit at the edge of digital transformation.
As AI becomes embedded in contact centers, self-service, automation, analytics and customer data environments, the risk profile around CX technology is expanding just as quickly.
The Enterprise Security Model Has to Change
The first requirement for enterprises is acceptance that AI has changed the operating environment, regardless of whether organizations feel ready, Gracely said.
“The reality is attackers don't really care about your opinion, your emotions around it. They're looking at it as ‘this makes my life easier, this makes my life faster in terms of being able to break into things or steal things or create situations that are advantageous to them.”
Enterprises need to recognize the seriousness of the shift, Gracely added.
“This is very much a moment that the enterprise needs to look at themselves and say, ‘I need to recognize this is this is a problem. This is the new world that we live in.”
The second step is a hard assessment of current response times. Even when patches for vulnerabilities are available, enterprise security cycles need to adjust to the speed with which AI can move. Gracely described the challenge enterprises face, as many organizations cannot deploy fixes quickly enough.
"The reality for most enterprise customers is the amount of time it takes them to get from getting that patch to getting it into their systems that are live, oftentimes takes quite a long time, 40 days, 50 days, 90 days," Gracely noted. "When the volume of of vulnerabilities is growing, obviously because of AI tools and the amount of software being written, and the velocity of them is growing, now we run into a bottleneck in which we can get customers fixes and patches, but if they're not able to get them put into their systems fast enough, they leave themselves with the same vulnerabilities."
That lag is becoming more dangerous in an AI-driven environment. The central commercial and operational pressure behind Project Lightwell’s launch is that AI is compressing timelines. Enterprises cannot assume that security processes designed for a slower software era will be sufficient.
That makes the “patch to production challenge” gap that Gracely described a customer trust problem.
“The marketplace isn't going to say, ‘Well, I'm sure you're trying really hard, but you know we'll get there,’” Gracely added.
For CX teams, that bottleneck poses a substantial risk. Customer-facing systems often sit across complex technology stacks incorporating CRM platforms, contact center software, chatbots, identity tools, payment systems, analytics platforms and integrations with third-party applications. A vulnerability in one area can have consequences across the customer journey.
A CX Wake-Up Call on Technical Debt
Project Lightwell’s AI-driven automation pipeline combines frontier and open-source AI models with human engineering expertise that is designed to help enterprises identify patch and remediate vulnerabilities embedded deep within open-source software. The launch comes as tools powered by frontier AI models are increasing both the volume of code being created and the speed at which vulnerabilities can be exploited.
The initiative delivers automated vulnerability remediation through two offerings: Lightwell Network and Lightwell Clearinghouse Premier. Available now, Lightwell Network gives enterprises access to a launch catalog of more than 6,500 remediated, digitally signed and certified application-layer dependencies across major ecosystems, including Java and Python. Lightwell Clearinghouse Premier has entered limited availability, serving as an intermediary for secured patch embargoes and vertical threat coordination.
One of the strongest messages from the Lightwell launch is that traditional enterprise upgrade cycles may no longer be compatible with AI-era risk. Many customer experience environments have accumulated technical debt over time. Legacy contact center infrastructure, customized CRM workflows, ageing integrations and manually managed systems can all slow down response times when vulnerabilities emerge.
There is a sense of frustration among security professionals that the warnings they have been sounding for several years have gone unheeded.
“This is something that vendors and security companies have been talking about for a long time,” Gracely said. “It's technical debt that has been accruing… the bill on your technical debt is coming due.”
However, AI is turning that long-standing issue into an immediate concern.
“This is becoming very much a wake-up call for companies that have ignored that or felt like they don't really need to do those things.”
Customer experience teams have often prioritized speed, convenience and personalization, sometimes layering new tools on top of old infrastructure to deliver better digital journeys. But as AI increases the pace of attack, slow-moving back-end systems can undermine front-end innovation.
Gracely stressed that this is part of a broader shift in how enterprises must think about AI risk, adding that the urgency “isn't specific to Lightwell. It's the nature of the give and take of Al.”
AI can improve productivity and help enterprises respond faster, but attackers have access to the same acceleration.
“It can be a really powerful tool in terms of helping them,” Gracely said. “But at the same time, where they're playing defense, the people playing offense against them also have those tools.”
That dynamic is changing the expectations around enterprise CX. If an AI-powered customer platform can be deployed quickly, then the security model around it must be able to adapt just as quickly. Enterprises “have to be conscious” of the new threat in the marketplace,” Gracely warned.
While the release of frontier models like Anthropic’s Mythos and Fable are drawing attention to the potential threats posed by advanced AI capabilities, Gracely pointed out that AI poses a broader risk.
